Valorant Dev Riot Games Responds To Anger Over Invasive Vanguard Anti-Cheat System

The Vanguard kernel loads at boot, a component designed to run in Ring 0 of the Windows kernel, the highest possible access level Windows offers. The kernel anti-cheat driver is called ‘vgk.sys’

Reading Time: 3 minutes

Valorant Dev Riot Games Responds To Anger Over Invasive Vanguard Anti-Cheat System

Valorant Dev Riot Games Responds To Anger Over Invasive Vanguard Anti-Cheat System

The kernel anti-cheat driver is called ‘vgk.sys’, so if you have Valorant installed on your PC, you may notice that in your list of background processes, even when not running the game. For comparison, systems like VAC, BattlEye and EasyAntiCheat all load up once you launch a game and don’t run in the background after closing the game down. Like a lot of online shooters, Valorant uses anti-cheat technology to help minimize trouble caused by unscrupulous players. It’s called Vanguard, and as described on Riot’s support site, it consists of a client that runs while the game is active, and a kernel mode driver that’s always on. That seems to be making some players nervous: As noted in this Reddit thread, for instance, the kernel has full administrator rights in Windows, and the only way to prevent it from loading is to either rename the file so it can’t be loaded, or uninstall it entirely.


Riot Games Goes Nuclear With Vanguard

Vanguard, the FPS game’s anti-cheat system, “contains a driver component called vgk.sys (similar to other anti-cheat systems),” the dev explains, which is “the reason why a reboot is required after installing”. Basically, the system doesn’t trust a PC unless the Vanguard driver “is loaded at system startup”, a part which he adds is “less common for anti-cheat systems”.

This is a good way of “stopping cheaters”, the post continues, “because a common way to bypass anti-cheat systems is to load cheats before the anti-cheat system starts and either modify system components to contain the cheat or to have the cheat tamper with the anti-cheat system as it loads. Running the driver at system startup time makes this significantly more difficult.”

The reason for this is that cheaters can bypass anti-cheat systems by loading the cheats themselves before the anti-cheat system has a chance to start. Running the anti-cheat driver at startup makes it harder for cheat software to tamper with the main game.

However, there are still understandable security concerns here, as a flawed driver with escalated privileges could spell disaster and provide an entry point for hackers to run rogue code without the user knowing. With that in mind, RiotArkem explains that the studio has consulted “multiple external security research teams” to review it for flaws. The driver component of the anti-cheat system is also supposed to do “as little as possible”, passing on the majority of the work to the non-driver component, which doesn’t kick in until Valorant is actually launched.

The driver “does not collect or send any information” about the user’s PC back to Riot and any cheat detection scans will take place when Valorant is running. With that in mind, it should not be scanning your PC in the background without your knowledge. Finally, the Vanguard driver (vgk.sys) can be uninstalled from your PC at any time, although the studio assures that it does not communicate over networks or collect information from your PC.

Given that Vanguard isn’t monitoring players data while Valorant isn’t active and that the software utilizes as little system resources as possible, surely these are an amicable price to pay in exchange for a guaranteed level playing field?

For now, however, Valorant’s anti-cheat will continue to boot alongside Windows.

Rate This And Share:

0 / 5